41bbbe806b787ebbd8f8ac5f813a00ed4b822e500ecacabcd3ff94ff21e06c24

Analysis

max time kernel
90s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 01:39

Target

DPlayer_lv/QtCore4.dll
Size

2.4MB
MD5

333479a7a67da81e316d4ee55682e75a
SHA1

62629b3691200a3385b765b966c5d0fce8b84fb0
SHA256

08ffea22ad878c021a46db9c1acc2b89b40371cf669a0eb0b32957d35b8963e1
SHA512

0577d03a66d06b36e9aef75915d58d8129245e537e04e298b719ff1035c5ea9719293fc4055c57480441c28946658493bdcd63659537924f595cb379a87c6462
SSDEEP

49152:t8xkQnEN/mISbJsv6tWKFdu9CRTLLyvL/6mShMZtmjNUVrciV5P+7QVg07EuIITg:ix38PyJsv6tWKFdu9Ck

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1912	1968	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1336 wrote to memory of 1968	1336	rundll32.exe	81
PID 1336 wrote to memory of 1968	1336	rundll32.exe	81
PID 1336 wrote to memory of 1968	1336	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayer_lv\QtCore4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\DPlayer_lv\QtCore4.dll,#1
  2⤵
  PID:1968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 648
    3⤵
    - Program crash
    PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1968 -ip 1968
1⤵
PID:4648